Recently, Sandvine, an Internet service provider in over 85 countries, has netflow reporting for netflixpublished a Spring 2011 Global Internet Phenomena Report on new Internet trends which show a steady increase in the usage of on-demand applications.¬† In North America, Netflix has become the single largest source of Internet traffic overall. These streaming applications can become a real burden when they start affecting business critical applications; this begs the question, “how can you use NetFlow to identify Netflix traffic?”

How to monitor Netflix traffic

Since Netflix uses a common web port (80) for data transfers, it can be difficult to identify Netflix from other web applications with NetFlow v5. The good news is that this task is easily accomplished with IPFIX NetFlow URL exports from vendors such as nProbe, SonicWALL, Flow Auditor and Citrix AppFlow.

Let’s look at an example Netflix nProbe URL report. We took a break from our day-to-day activities to stream Whale Wars on Netflix. Since our Internet traffic goes through an nProbe, which is exporting URLs, all we had to do was run a nProbe Top URLs report and then add an Advanced Filter for HTTP_URL then tell it to look for Netflix.

Netflix Traffic Analysis

You can see that in under 20 minutes we had already streamed over 2Gb of Netflix traffic.

How to alert on Netflix traffic

Now the question is, “how can we be alerted if someone is streaming Netflix?” Our NetFlow and IPFIX analyzer has the ability to trigger alarms on any report that you generate. So all we need to do is create an¬†inbound traffic threshold for the nProbe Netflix URL report above. Now you’ll start getting Netflix IPFIX alarms when someone starts streaming a Netflix video.

Netflix Netflow Alarms

This is one of the many ways to use our NetFlow and IPFIX analyzer to answer the age old question “Why is the network slow?”

Paul Dube

Paul Dube is the Technical Support Manager at Plixer. He has a passion for enabling individuals and organizations to use highly complex systems to solve business and personal objectives. This passion for problem solving has Paul working with some of the largest enterprises to solve their security and networking challenges and also educating his young daughters on how to enrich their lives with technology. When he's not working, you will find him enjoying time with his family, cooking something delicious on the Big Green Egg, and enjoying the best brews that the locals have to offer.


3 comments on “Netflix Traffic Analysis

  1. Great tool. Can it also show me what kind (based of URL or something) of netflix movie it is? Meaning… we know netflix is being used on the network but now I need to know what kind of movie/show is being played – a more, let’s say undesirable, show being viewed is different than if trying to catch up on the latest Blue’s Clues – at least in my environment.

  2. Hi Jason.

    The URLs that are generated by Netflix do not have that information in them. This will not tell us what particular movie we are playing. Basically nProbe and NBAR is allowing us to view layer 7 application data. This is giving us URL information. There is no level higher on the OSI model.

    You can possibly contact Netflix and see what their logic is to their URL generation. It may be generating random URL information dur to distributed servers.

    I hope this helps.


  3. Ben… thanks for the reply. That’s what I was thinking too but thought I’d ask. I would think Netflix would protect themselves by doing as you say but I’ll contact them to see.
    Thanks again.

Comments are closed.